What Survives Self-Evolution: Provenance Marks in Copied Agent Harnesses
Provenance marks in leaked agent harnesses mostly fail when a self-evolving LLM rewrites the marked code.
The paper measures whether provenance marks survive a covert rewriting attack in which a leaked agent harness is run through a published self-evolver and shipped as original work. Across three evolvers, five proposers and two environments, KGW in the prompt survives GEPA rewrites in 0 of 12 copies and released AgentMark in 5 of 12. A new mark keyed to the order of near-tied table entries is detected in 62 of 76 rewritten copies on held-out games, but a scheme-aware plagiarist can reshuffle ties at no measurable cost, and requests for more general code remove the key in 75-100% of rewrites. The scenario is motivated by Claude Code's 512,000 lines being mirrored within hours of a packaging error.
- KGW prompt watermarks survive zero of 12 GEPA rewrites.
- Released AgentMark survives five of 12 copies.
- A new tie-order mark is detected in 62 of 76 copies.
- Reshuffling ties or requesting general code strips the mark.
- Claude Code's 512,000-line mirror motivates the copied-harness threat.
- Vendors
- Anthropic
- Products
- Claude Code
From the original article
1 min read at arxiv.orgAgent harnesses, the prompt and tool code around a base model, leak. Claude Code's 512,000 lines were mirrored within hours of a packaging error. A plagiarist can pass a leaked harness through a published self-evolver and ship the result as its own.
By Jieyu Li · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.